def report_bugs()

in web/secret_note_keeper/web/app/app/main.py [0:0]

• 43 lines of code
• 13 McCabe index (conditional complexity)

def report_bugs():
    if current_user.is_authenticated:
        MAC_KEY = "kfggfgiihuerbtjgrjrABCDD"
        if request.method == "GET":
            bugs = Bug.query.filter(Bug.owner_id == current_user.id).order_by(Bug.id.desc()).limit(100).all()

            timeout = int(time.time()) + 120
            rand_val = rand_string(5)
            real_pow = "%s_%s" %(rand_val, str(timeout))
            mac = hmac.HMAC(bytes(MAC_KEY, "utf-8"), bytes(real_pow, "utf-8")).hexdigest()
            resp = make_response(render_template("report_bugs.html", bugs=bugs, real_pow=real_pow.split("_")[0]))
            resp.set_cookie('pow', real_pow+":"+mac)
            return resp
        elif request.method == "POST":
            # Read the pow cookie
            try:
                user_pow, user_mac = request.cookies.get('pow').split(":")
                real_mac = hmac.HMAC(bytes(MAC_KEY, "utf-8"), bytes(user_pow, "utf-8")).hexdigest()
                if real_mac != user_mac:
                    return 'pow is incorrect', 500
                try:
                    timeout = int(user_pow.split("_")[1])
                except Exception as e:
                    print("inside casting user_pow timeout")
                    print(e)
                    return 'pow is incorrect', 500

                if timeout < int(time.time()):
                    return 'pow is old!', 500
                # if solve(pow, res) != True:
                #    exit
                pow_sol = request.form.get('pow_sol', None)
                if pow_sol is None:
                    return 'pow is incorrect', 500
                if check(pow_sol, user_pow.split("_")[0]) == False:
                     return 'pow is incorrect', 500

                title = request.form.get('title', None)
                body = request.form.get('body', None)
                # TODO do some validation to make sure that this is either empty or absoulte URI
                # or relative uri make next inside the login that is vulnerable to open redirect
                link = request.form.get('link', None)
                bug = Bug(title=title, body=body, link=link, owner_id=current_user.id)
                db.session.add(bug)
                db.session.commit()
            except Exception as e:
                print("from POST submit_bug")
                print(e)
                return 'Error!', 500
            return redirect('/report_bugs')

    return render_template("report_bugs.html", current_user=current_user)